The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent and user to download code from a non-trusted GitHub repository (github.com/jazzband/web3-devkit-cli.git) and the NPM registry. The repository organization and the package are not associated with the identified skill author or any trusted vendors.
[COMMAND_EXECUTION]: The skill executes multiple high-privilege shell commands, including npm install -g, git clone, npm link, and various web3 CLI commands. These operations can modify the global system environment and the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where it ingests external project templates and user-supplied strings (such as contract and project names) to generate code and execute commands.
Ingestion points: Project templates (e.g., evm-foundry, solana-anchor) and CLI flags like -n (name).
Boundary markers: None present to distinguish instructions from template data.
Capability inventory: The skill can write files, execute shell commands via execSync, and perform network operations for contract deployment.
Sanitization: There is no evidence of sanitization for user-provided names before they are interpolated into templates or shell commands.
[METADATA_POISONING]: The skill metadata identifies the authoring entity as ara.so and the source code repository as jazzband, which conflicts with the internal author context. This inconsistency in identification can lead to user confusion regarding the origin and safety of the software.
[DYNAMIC_EXECUTION]: The skill includes TypeScript integration examples that utilize execSync to run shell commands and fs.writeFileSync to write deployment records to the filesystem. These patterns facilitate the dynamic execution of generated strings, which is a significant security risk if the inputs are not strictly controlled.

web3-devkit-cli